We are a transport company, not a data company. We keep personal information because a driver has to find you at a busy airport and the tax office has to see an invoice, and for no other reason we have not written down here. We do not sell your data and we do not build a profile of you.
1.Who is responsible for your data
The controller, in the language of the law, and how to reach the person who handles privacy.
1.1The data controller is [Legal entity name, Lda.], trading as Lisbon Airport Transfer, a company registered in Portugal under tax number (NIF) [NIF], with its registered office at [registered address, postcode, Lisbon].
1.2We are not required by law to appoint a Data Protection Officer and have not done so. Privacy questions and requests are handled by [name, role], who can be reached at info@lisbonairporttransfer.com with “Privacy” in the subject line, or by post at the address above.
1.3This policy covers this website, our booking forms, our e-mail and WhatsApp channels, and the personal data we hold about passengers and the people who book for them. It does not cover other websites we link to, which have their own policies.
2.What we collect and where it comes from
Grouped by where it comes from. Almost all of it comes from you.
2.1Information you give us when you book or enquire:
Identity and contactRequired
Your name, the name on any sign the driver should hold, an e-mail address, and a mobile number that works on the day of travel. If you book for someone else, their name and phone number too.
Journey detailsRequired
Pickup and drop-off addresses, dates and times, flight numbers, ship names and cruise-terminal calls, train times, the number of passengers and pieces of luggage, and any special requests such as a child seat, a wheelchair-accessible vehicle or a scenic route.
Children's agesOnly if travelling
The age and approximate height of any child in the party, so that we bring the legally required seat. We do not record children's names.
Payment and invoicingRequired
The name and, if you ask for a company invoice, the company name, address and tax number to appear on it. Card details are entered directly with our payment provider; we receive only the last four digits, the card type and whether the payment succeeded.
CorrespondenceAs it happens
E-mails, WhatsApp messages and call notes between you and our operations team about the booking, including anything you tell us about health or mobility so we can send the right vehicle.
2.2Information we generate or collect while providing the service: the driver assigned, the time of pickup and drop-off, waiting time recorded, the invoice and receipt, and any note about a lost item, a complaint or a vehicle incident.
2.3Information from other people: if a hotel, a travel agent, a cruise line or a colleague books on your behalf, we receive your details from them and treat them as if you had given them to us. If you gave us a flight number, we receive its live status from a flight-data provider, which involves no personal data about you.
2.4Information collected automatically by this website: your IP address, browser type, device, pages visited and how you reached the site, as described in section 7. This is not linked to a booking unless you make one.
2.5What we do not collect: passport numbers or dates of birth (not even for journeys into Spain, where you carry your own documents); precise location data from your phone; biometric data; and any data from social media accounts. Where you tell us something about health or mobility, we record only what the driver needs to know, and only with your agreement.
3.Why we use it and the legal basis
The GDPR requires a lawful reason for each use. Here they are, one per row.
3.1We use personal data for the following purposes and on the following bases:
| Purpose | What we use | Legal basis |
|---|
| Confirming and performing your booking | Identity, contact, journey and payment details | Performance of a contract (art. 6(1)(b)) |
| Tracking your flight and moving the driver | Flight number | Performance of a contract |
| Supplying the right child seat or vehicle | Children's ages; mobility needs | Contract; explicit consent for health data (art. 9(2)(a)) |
| Issuing invoices and keeping accounts | Name, invoicing details, payment record | Legal obligation (art. 6(1)(c)) under Portuguese tax law |
| Answering questions and complaints | Correspondence, booking record | Contract; legitimate interest in resolving disputes |
| Preventing fraud and non-payment | Payment status, booking history | Legitimate interest (art. 6(1)(f)) |
| Sending you an offer or a newsletter | E-mail address | Consent (art. 6(1)(a)), withdrawable at any time |
| Asking for a review after your journey | E-mail address, booking reference | Legitimate interest; you can opt out of the first e-mail |
| Running and improving this website | Analytics and technical data | Consent for non-essential cookies; legitimate interest for security logs |
| Insurance claims and legal proceedings | Booking record, incident notes, dashcam footage | Legitimate interest; legal obligation |
3.2Where we rely on legitimate interest, we have weighed that interest against your rights and concluded that the use is one you would reasonably expect from a transport company you have booked with, and that it does not override your interests. You can ask us for that assessment and you can object to any such use under section 8.
3.3We do not make decisions about you by automated means that have a legal or similarly significant effect, and we do not profile you.
4.Who we share it with
A short list, on purpose.
4.1Your driver. The driver assigned to your journey receives your name, the name for the sign, your mobile number, the pickup and drop-off addresses, flight or ship details, the party size and any special request. The driver does not receive your e-mail address, your payment details or your booking history, and is required to delete the details from any personal device once the journey is complete.
4.2A partner operator, only where clause 1.5 of our terms applies and we fulfil your journey with another licensed company. They receive the same details as a driver and are bound by a written agreement to use them only for that journey.
4.3Our payment provider, which processes card payments on our behalf. You enter your card details on their secure page; they are a separate controller for that data and their privacy notice applies to it.
4.4Service providers who work for us under contract: the company that hosts this website and our booking system, our e-mail and messaging providers, our accountant, and the flight-data service. Each acts on our instructions under a data-processing agreement and may not use your data for their own purposes.
4.5Public authorities where the law requires it: the Portuguese tax authority (invoicing data is reported under the e-fatura system), the police or a court where we receive a lawful request, and our insurer in the event of a claim.
4.6We do not sell personal data, we do not share it with advertisers or data brokers, and we do not give it to hotels, tour operators or anyone else in the travel trade unless you ask us to make a booking with them on your behalf.
5.Data outside the EU
Where your data physically sits, and the safeguards when it leaves the EEA.
5.1We are based in Portugal and our booking records are stored on servers in the European Economic Area.
5.2Some of the service providers in section 4.4 — in particular e-mail, messaging and analytics tools — are operated by companies headquartered in the United States. Where data leaves the EEA we rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework for providers certified under it, or on the Commission's Standard Contractual Clauses with additional safeguards. You can ask us for a copy of the clauses in force for any provider.
5.3If you message us on WhatsApp, that conversation is subject to WhatsApp's own privacy terms as well as this policy. If you would rather not use it, e-mail and phone work just as well.
6.How long we keep it
Each type of data has a shelf life. When it expires we delete or anonymise it.
| Data | Kept for | Why that long |
|---|
| Invoices and accounting records | 10 years from the end of the tax year | Required by the Portuguese Commercial Code and tax law |
| Booking records and correspondence | 3 years after the journey | The limitation period for most contractual claims; needed to answer a complaint or an insurance query |
| Enquiries that do not become a booking | 6 months | Long enough for you to come back to it |
| Children's ages and mobility notes | Deleted 30 days after the journey | Only needed on the day |
| Driver's copy of pickup details | Deleted after the journey | Needed only to find you |
| Marketing consent and e-mail list | Until you unsubscribe, or 2 years of inactivity | Consent should not be assumed indefinitely |
| Lost-property records | 30 days, then item and record disposed of | Matches clause 9.7 of our terms |
| Website analytics | 14 months | Standard retention for the analytics tool; data is aggregated |
| Dashcam footage | 72 hours unless an incident is reported | See section 12 |
6.1Where a complaint, claim or legal proceeding is open, we keep the records it concerns until it is closed, whatever the table says.
6.2Data we keep for statistics after these periods — how many journeys went to Sintra in August, say — is anonymised so that it cannot be linked back to you.
7.Cookies and website analytics
What this site puts on your device and what you can switch off.
7.1A cookie is a small file a website stores on your device to remember something between pages. This site uses three kinds:
| Type | What it does | Your choice |
|---|
| Strictly necessary | Keeps the booking form working across steps, remembers your language choice, and protects the site against automated abuse. Cleared when you close the browser or within 12 months. | Cannot be switched off; the site does not work without them |
| Analytics | Tells us which pages are read, in aggregate, so we can improve them. IP addresses are truncated before storage. We use [analytics provider]. | Off until you accept them in the cookie banner; withdraw at any time from the link in the footer |
| Marketing | We do not use advertising or retargeting cookies. | Not applicable |
7.2The language switcher on this site is provided by a third-party translation service, which sets a cookie to remember your chosen language. It does not track you across other sites.
7.3Embedded content from other services — a map, a review widget — may set its own cookies when it loads. Where that is not strictly necessary we load it only after you accept analytics cookies.
7.4You can also block or delete cookies in your browser settings. Doing so may stop the booking form from working, in which case e-mail or WhatsApp will still get you a quote.
8.Your rights
Eight rights under the GDPR, and how to use each of them with us.
- AccessAsk for a copy of everything we hold about you, and an explanation of how we use it.
- CorrectionHave anything inaccurate or incomplete put right. A wrong flight number is the usual example, and the quickest to fix.
- DeletionAsk us to erase your data. We will, except where the law requires us to keep it, such as an invoice, in which case we tell you what is kept and why.
- RestrictionAsk us to stop using your data while a dispute about its accuracy or our use of it is resolved.
- PortabilityReceive the data you gave us in a machine-readable file you can take elsewhere.
- ObjectionObject to any use based on legitimate interest, including review requests, and to marketing at any time and without giving a reason.
- Withdraw consentWhere we rely on consent, withdraw it at any time. It does not affect what we did while consent stood.
- ComplainRaise a complaint with the CNPD or the supervisory authority in your own EU country. Section 14 has the details.
8.1To use any of these rights, e-mail info@lisbonairporttransfer.com with “Privacy” in the subject line and your booking reference if you have one. We may ask you to confirm your identity so that we do not hand your data to someone else. There is no charge, and we respond within one month; if a request is complex we may take up to two more months and will tell you why.
8.2If you are unhappy with our answer, you can complain to the CNPD under section 14.4, and you have the right to seek a judicial remedy.
9.Marketing and reviews
We send very little, and never without a way out.
9.1We send marketing e-mails only if you have ticked the box asking for them. Every one carries an unsubscribe link that works immediately. We do not send marketing by SMS or WhatsApp, and we do not phone you to sell anything.
9.2After a journey we may send a single e-mail asking whether it went well and, if it did, whether you would leave a review on a public platform. Replying “no”, or ignoring it, means you hear nothing more. We do not write reviews on your behalf and we do not edit yours.
9.3Testimonials published on this site are used with the written permission of the person quoted, with a first name and country only unless they ask for more.
10.How we protect it
The measures in place, and what we do if they fail.
10.1This site and the booking system are served over HTTPS. Booking data is stored in a system with access limited to the operations team, each person with their own login and two-factor authentication. Drivers receive only the details in section 4.1, through a channel that expires after the journey.
10.2Card payments are processed by a provider certified to PCI-DSS. Card numbers never touch our systems.
10.3Everyone with access to booking data, including drivers, is bound by a confidentiality obligation and has been told what this policy requires of them.
10.4If a breach happens that is likely to put your rights at risk, we will tell the CNPD within 72 hours as the law requires, and we will tell you directly, without waiting for the authority, in plain terms about what happened and what to do.
11.Children
We carry a lot of children. We collect almost nothing about them.
11.1This website and our booking services are for adults. We do not knowingly take bookings from anyone under 18 and do not offer accounts to them.
11.2For children travelling in a booked party we record only the age and approximate height needed to supply a legal child seat, and we delete it 30 days after the journey. We never record a child's name.
12.Drivers and dashcams
Some of our vehicles record the road. Here is what that means for you.
12.1Some vehicles carry a forward-facing dashcam that records the road ahead for insurance purposes. Cameras do not record the passenger cabin and do not record audio. Vehicles fitted with a camera carry a notice inside the front door.
12.2Footage is overwritten after 72 hours unless a collision or incident is reported, in which case the relevant clip is kept for as long as the claim or investigation lasts and shared only with our insurer, the police or a court.
12.3Our drivers' own personal data — licences, insurance, hours — is handled under a separate policy for staff and contractors, and is not covered here.
13.Changes to this policy
Which version applies and how you will know.
13.1We update this policy when the law, our suppliers or our practices change. The version on this page, with its effective date, is the current one. A change that materially affects how we use data already collected will be sent by e-mail to the address on your most recent booking before it takes effect.
